1 CEO, CFO & CIO Engagement in Information Technology Management: The Disciplinary Effects of Sarbanes-Oxley Information Technology Material Weaknesses Discussant Report Terry Hung - PricewaterhouseCoopers

2 Author’s Motivation or Justification The author’s justification that companies reporting IT material weaknesses should result in CEO and CFO becoming more involve with IT management should not be the sole reason for them being involved. The study focuses too much on the consequences of reported material weaknesses, rather than looking at demonstrating the value of IT to senior management. The alignment of business strategic goals to the investment in IT should be a better motivation for CEO and CFO involvement.

3 Theoretical Support The results are taken from 2004 and 2005 reports. The results could be outdated. Since the initial introduction of SOX in 2004, reported material weaknesses have been on the decline due to the improve controls implemented. Would the study done on recent reports provide the same conclusions? The author suggests the delegation of responsibility of senior management involvement in IT activities to the CIO introduces agency problems, such as agency costs, which include monitoring and residual losses. Not sure what the alternative solution should be and whether the alternative solution would be more cost effective.

4 Research Method Deployed The author has admitted to limitations in the method deployed: -The SOX standards leads to judgement as to the qualitative nature of a “material weakness” on the part of the reporting firm and their auditors and may be different to another report firm and auditors. -Data examined the initial wave of SOX 404 reports may be markedly different than SOX 404 reports in subsequent periods. -Executive turnover may be driven by voluntary turnover.

5 Analysis of Results The study does not look at the lack of other business mitigating and compensating controls that could have detected an IT material weakness. If business controls cannot detect systemic IT material weaknesses, there is a stronger argument for laying responsibility on the CEO and CFO.

6 Conclusion Agree with the author’s conclusion that the CEO and CFO are accountable for serious IT problems, but it should not be focused only on SOX related control weaknesses.

7 Contribution to Practice Effective IT general control should contribute to an organization’s overall internal control structure. In practice, senior management are more interested in timely and quality IT service delivery that aligns with the company goals. CEOs and CFOs are generally interested in SOX IT material weaknesses as they are certifying on the operating effectiveness of the controls. More interested if it directly impacts their compensation or employment, or if monitored by Audit Committees.

8 Exposition The conclusion makes sense. Practitioners may find the statistics difficult to understand.

9 Terry Hung is a Managing Director with the Advisory Services at PricewaterhouseCoopers LLP. Contact Details: (416) or The views and opinions expressed herein are those of the discussant and do not necessarily represent the views and opinions of PricewaterhouseCoopers LLP.